Google Chrome CVE-2026-79119

Exploitation requires that a user actively opens a crafted PDF file in Google Chrome's built-in PDF renderer - user interaction is mandatory (UI:R in CVSS vector). No authentication, special privileges, or non-default configuration is required; Chrome's default PDF rendering behavior is sufficient. The attack vector is network-based (AV:N), meaning the PDF can be delivered via web or email, but the user must explicitly open it. Key limiting factors: (1) execution is confined to Chrome's renderer sandbox - a sandbox escape is needed for host-level compromise; (2) the attack is not automatable per SSVC, ruling out mass-exploitation at scale without user interaction; (3) the vulnerability is in Chrome's PDF subsystem specifically, so only PDF files (not general web pages) serve as delivery vehicles. Organizations that route PDF opens to external viewers bypass Chrome's vulnerable parser entirely.

CVSS 8.8 signals high severity based on network reachability, no authentication requirement, and full C/I/A impact on the vulnerable component. However, several signals substantially temper real-world risk. First, Chrome's own severity rating of 'Low' reflects that sandboxed RCE - while dangerous - does not equate to host compromise without a separate sandbox escape. Second, SSVC assesses exploitation as 'none' and the attack as non-automatable, consistent with the UI:R requirement (user must open a malicious PDF) and the absence of any known POC or KEV listing. Third, EPSS data is not provided, preventing probabilistic exploitation likelihood assessment. The net assessment is that this is a real but mitigated browser memory corruption flaw: prioritize patching for high-value targets (executives, security teams, users handling untrusted PDFs), but the lack of active exploitation and sandboxed impact reduces urgency compared to a network-exploitable, privilege-escalating flaw. The CVSS 8.8 vs. Chrome 'Low' discrepancy should be verified with the vendor advisory.

An attacker hosts or emails a specially crafted PDF designed to trigger the use-after-free condition in Chrome's PDF parser. A target user opens the PDF directly in Chrome (either via a web link or email attachment), causing the memory corruption that redirects execution to attacker-controlled code running within Chrome's renderer sandbox. No public proof-of-concept exploit exists at time of analysis, and chaining this to a full system compromise would require an additional sandbox escape vulnerability.